C1000-163 Multi-Tenancy Considerations

Multi-Tenancy Considerations Detailed Explanation

This topic focuses on deploying and managing IBM Business Automation Workflow (BAW) in a multi-tenant environment, where multiple clients (tenants) share the same system. Effective multi-tenancy setup allows for data isolation, resource allocation, and security customization for each tenant.

Goal: Understand how to deploy and manage IBM BAW in a multi-tenant environment, ensuring data and service isolation for each tenant.

In a multi-tenant architecture, one BAW instance serves multiple tenants (clients or departments) while keeping each tenant’s data, resources, and security isolated. This setup is commonly used in cloud environments, where a single instance of BAW supports multiple customers without compromising privacy or performance.

A. Multi-Tenant Architecture

The architecture of a multi-tenant BAW system should ensure that each tenant's data and user access are fully isolated. This isolation is critical to protecting each tenant’s information and ensuring that one tenant’s actions do not affect another.

1. Logical Isolation

Logical isolation separates each tenant’s data within the same database system, typically using different database schemas or tables.

• Database Schemas or Tables: Use separate schemas or tables for each tenant to keep their data isolated. For example, you could create a unique schema per tenant in the same database instance.

  • Example: Tenant A’s data is stored in schema “TenantA_DB,” while Tenant B’s data is stored in schema “TenantB_DB.” This approach prevents tenants from accessing each other’s data.

• Data Partitioning: Data partitioning by tenant enables better performance and security by reducing data overlap.

  • Example: In a workflow system, each tenant’s tasks, logs, and records are stored in separate tables, ensuring they’re accessible only to the respective tenant.

Logical isolation ensures that data remains strictly separate even though tenants share the same BAW environment. This setup is essential for privacy and regulatory compliance.

2. User Permission Isolation

Each tenant requires its own user roles and permissions to control access within the organization while ensuring that tenants cannot access each other’s users or roles.

• Role and Permission Management: Define unique roles and permissions for each tenant. This setup allows each tenant to control access to their workflows, data, and settings.

  • Example: Tenant A may have roles like “Admin,” “Editor,” and “Viewer,” with permissions specific to their workflows, while Tenant B has similar roles but cannot see or access Tenant A’s data.

• Non-Overlapping Permissions: Ensure that permissions for each tenant do not overlap. Each tenant should manage its users independently, with no shared access.

  • Example: If Tenant A’s admin has access to sensitive reports, this access should not extend to Tenant B, even if they share similar roles.

By isolating permissions, BAW provides each tenant with control over its users and data, ensuring full independence within the shared environment.

B. Resource Allocation

Resource allocation in a multi-tenant environment ensures that each tenant receives sufficient system resources (CPU, memory, and storage) without affecting other tenants’ performance. This isolation improves both system reliability and the tenant experience.

1. Resource Isolation

Resource isolation limits the amount of system resources each tenant can use, preventing one tenant’s heavy usage from slowing down the system for others.

• CPU and Memory Allocation: Assign specific CPU and memory quotas to each tenant, so high usage by one tenant doesn’t cause performance issues for others.

  • Example: If Tenant A is a larger client with higher workload requirements, allocate more CPU and memory to their processes while keeping Tenant B’s resources separate.

• Storage Limits: Define storage limits for each tenant to ensure they don’t use up all available storage, which could affect other tenants.

  • Example: Set storage quotas based on the size of each tenant’s data needs, so tenants with more extensive data requirements don’t impact the storage available for smaller tenants.

By allocating resources per tenant, BAW can ensure a balanced distribution of system resources, preventing one tenant’s needs from impacting others.

2. Security Control

Each tenant in a multi-tenant environment may have unique security requirements. Allowing tenants to define independent security policies enables BAW to meet each tenant’s specific needs.

• Customizable Security Policies: Each tenant should be able to define and manage their own security policies, such as password requirements, two-factor authentication, and data encryption.

  • Example: Tenant A might require multi-factor authentication for all users, while Tenant B might only require it for administrators. Each tenant can set these policies independently within BAW.

• Compliance Requirements: Some tenants may have industry-specific compliance needs, such as GDPR or HIPAA. The ability to customize security controls allows tenants to configure BAW to meet these compliance standards.

  • Example: Tenant C, a healthcare provider, might enable additional encryption and auditing settings to meet HIPAA compliance, while other tenants may not require the same level of protection.

Security control allows each tenant to tailor BAW’s security to meet its own policies and regulatory requirements.

Key Point: Ensure Data Security, Resource Isolation, and Personalized Services in a Multi-Tenant Environment

In summary, Multi-Tenancy Considerations ensure that IBM BAW can securely support multiple tenants within a single system instance. By separating data, permissions, resources, and security, each tenant receives a personalized, secure experience.

1. Data and Permission Isolation: Use logical isolation and separate user roles to keep tenant data and permissions fully isolated.
2. Resource Allocation: Limit CPU, memory, and storage for each tenant to prevent one tenant’s usage from impacting others.
3. Customizable Security Policies: Allow tenants to define their own security settings to meet their unique needs and compliance requirements.

By implementing these multi-tenancy strategies, IBM BAW can securely and efficiently serve multiple tenants, ensuring privacy, resource stability, and tailored security for each one.

Multi-Tenancy Considerations (Additional Content)

1. Overview of Multi-Tenancy in QRadar

IBM QRadar SIEM supports multi-tenancy, allowing multiple independent entities (e.g., departments, subsidiaries, MSSP clients) to share a single QRadar instance while maintaining strict data isolation, access control, and resource allocation.

Key Objectives of Multi-Tenancy in QRadar

Log Data Isolation – Tenants can only access their own logs.
Custom Security Policies – Each tenant can define its own correlation rules.
Resource Allocation – EPS (Events Per Second) and storage are managed per tenant.

2. QRadar Multi-Tenancy Architecture

QRadar uses a Domain-Based Access Control (DBAC) model, which ensures tenants can only see and manage their own data.

2.1 Log Source Management (Log Source Multi-Tenancy)

Each tenant has dedicated log sources, and cross-tenant log access is strictly prohibited.

Tenant	Accessible Log Sources
Finance (Tenant A)	Financial systems, accounting servers
HR (Tenant B)	HR application logs, employee records
IT Security (Tenant C)	Firewalls, IDS/IPS, endpoint logs

Example:
Tenant A (Finance) cannot see login events from HR systems.
Tenant B (HR) cannot see security logs from firewalls.

2.2 Offense and Event Segmentation

In a multi-tenant setup, QRadar ensures that:

• Each tenant's security events (Offenses) are isolated.
• Tenants only see their own alerts and security incidents.

Example:

• Tenant A detects multiple failed logins on finance servers.
• Tenant B is unaware of this event, as it does not affect its domain.

3. Access Control in Multi-Tenant Environments

Access control in QRadar multi-tenancy is based on Domain-Based Access Control (DBAC) and Security Profiles.

3.1 Domain-Based Access Control (DBAC)

QRadar assigns each tenant to a specific Security Domain, ensuring:

• Only assigned users can view tenant-specific logs.
• Administrators can control access at the domain level.

Role	Security Domain	Access Scope
Finance Admin	Finance	Financial logs & offenses
IT Admin	IT Security	Firewall, IDS/IPS logs
HR Admin	HR	HR access logs

Example:

• The HR Admin cannot query Finance logs.
• The IT Admin can access firewall logs but not HR activity.

3.2 Security Profiles in QRadar

Security Profiles restrict what users can do within their assigned domains.

Security Profile	Permissions	Use Case
Monitoring Only	Read-Only Access	SOC analysts monitoring offenses
Tenant Admin	Full Management	Managing tenant-specific rules & logs
Incident Response	Offense Management	Handling security incidents only

Example:

• A SOC analyst may only view offenses but not modify rules.
• A Tenant Admin can create security policies but cannot access logs from another domain.

4. Resource Management in Multi-Tenant QRadar

QRadar ensures fair resource allocation across tenants to prevent one tenant from monopolizing system resources.

4.1 Storage Segmentation

Each tenant can have custom log storage limits and retention periods.

Tenant	Storage Allocation	Log Retention
Finance	10 TB	180 Days
HR	5 TB	90 Days
IT Security	20 TB	365 Days

Example:

• HR logs are stored for 90 days, while IT logs are stored for a year due to compliance needs.

4.2 Event Processing Limits (EPS Allocation)

QRadar allows per-tenant EPS (Events Per Second) allocation, ensuring fair distribution of system resources.

Tenant	EPS Allocation
Finance	5000 EPS
HR	2000 EPS
IT Security	8000 EPS

Example:

• IT Security (SOC team) gets a higher EPS limit due to high network traffic monitoring.
• HR is allocated fewer EPS, as HR logs generate lower event volume.

Best Practice: Monitor EPS usage per tenant and adjust limits based on security requirements.

5. Rule Management in Multi-Tenancy

Each tenant manages its own correlation rules, ensuring that:

• Tenants cannot modify or view other tenants' security policies.
• Each tenant can create custom security alerts.

Multi-Tenant Rule Segmentation

Tenant	Custom Security Rule
Finance	Alert on multiple failed logins to accounting systems
HR	Alert on unauthorized access to employee records
IT Security	Alert on external brute-force attacks

Example:

• Finance cannot see or modify IT Security rules.
• Each tenant receives alerts only relevant to its domain.

Best Practice: Implement tenant-specific rule sets to prevent overlap or interference.

6. Best Practices for Multi-Tenancy in QRadar

Aspect	Best Practice
Log Data Isolation	Use DBAC (Domain-Based Access Control) to prevent tenants from accessing each other's logs.
Access Control	Assign Security Profiles to restrict users to their respective domains.
Resource Allocation	Set storage quotas and EPS limits to ensure fair usage.
Offense Segmentation	Ensure each tenant only sees its own security alerts.
Custom Rules per Tenant	Configure independent correlation rules for each tenant.

7. Summary

Key Takeaways

QRadar’s multi-tenancy model ensures strong data isolation using Domain-Based Access Control (DBAC).
Each tenant has dedicated log sources, storage limits, and event-processing capabilities.
Security profiles prevent unauthorized cross-tenant access to logs and offenses.
Resource allocation (EPS, storage) ensures fair usage across all tenants.
Custom rules and offenses are unique to each tenant, preventing unauthorized visibility.

By implementing proper multi-tenancy configurations, QRadar ensures that organizations and MSSPs can securely manage multiple customers or business units within a single SIEM environment.